1

I have the following script:

Param(
    [String[]] $targetMachines,
    [String] $targetMachineListFile,
    [String] $group,
    [String] $domain,
    [String] $user
)

if (-not ($targetMachines))
{
    $targetMachines = Get-Content $targetMachineListFile
}

foreach ($targetMachine in $targetMachines) 
{
    Write-Output "Adding domain user $user@$domain to $targetMachine"
    $de = [ADSI]"WinNT://$targetMachine/$group,group" 
    $de.Add("WinNT://$domain/$user")
    Write-Output "Done domain user $user@$domain to $targetMachine"
}

The problem is that when I add a user, it fails with the error:

Exception calling "Add" with "1" argument(s): "Access is denied.
"
At C:\Users\jz03qx\source\repos\misc\server-prep\Add-User-To-Remote.ps1:20 char:5
+     $de.Add("WinNT://$domain/$user")
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [], MethodInvocationException
    + FullyQualifiedErrorId : CatchFromBaseAdapterMethodInvokeTI
  • I have administrator access to the remote machine
  • I am running this in powershell with Administrator privileges.

What is wrong with the script? or what could be wrong with the setup?

1

My guess is that you're implicitly using authentication double-hop that is forbidden. When adding user to group at target machine, target machine is trying to resolve user in Active Directory. This however requires reauthentication to Active Directory that is forbidden.

Your can try creating a CredSSP based session to target machine and issue command in session. Example (not tested):

$credential = get-credential
$session = New-PSSession -ComputerName $targetmachine -Credential $credential -Authentication Credssp
Invoke-Command -Session $session -ScriptBlock {
    $de = [ADSI]"WinNT://$using:targetMachine/$using:group,group" 
    $de.Add("WinNT://$using:domain/$using:user")
}

See https://docs.microsoft.com/en-us/powershell/scripting/setup/ps-remoting-second-hop?view=powershell-5.1 for more info about double-hop and possible solutions.

CredSSP must be explicitly enabled! On client you must run:

Enable-WSManCredSSP -Role Client

And on server:

Enable-WSManCredSSP –Role Server

Be aware that CredSSP exposes your (basically plaintext) credentials to target machine. In case of compromise of target machine, your credentials will also be compromised.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.